For example, related techniques described in PTLs 1 to 3 are known as techniques for analyzing a fault in an information processing system.
A fault analysis system described in PTL 1 holds a normal pattern of a processing sequence and an abnormal pattern during a fault. When the fault occurs, the fault analysis system obtains a pattern (search pattern) of a processing sequence, and analyzes the fault by collating the pattern with the normal pattern and the abnormal pattern. This fault analysis system determines normal operation in a case where the search pattern matches the normal pattern. This fault analysis system presents information about the abnormal pattern in a case where the search pattern matches the abnormal pattern. This fault analysis system holds the search pattern as a new abnormal pattern in a case where the search pattern matches neither the normal pattern nor the abnormal pattern.
A fault analysis system described in PTL 2 records a usual pattern for each period and the number of times of occurrences thereof with regard to a message collected in a learning mode during normal operation of an information processing system. Then, this fault analysis system determines that an abnormality is detected in a case where there is not any usual pattern that matches the pattern of the message collected in the operation mode, or in a case where the number of times of occurrences thereof is equal to or more than the upper limit or equal to or less than the upper limit based on the number of times of occurrences of the usual pattern.
A fault analysis system described in PTL 3 detects a fault by collating as to whether a message pattern obtained during a fault occurred in the past and a message pattern obtained during an operation match each other or not. For example, this fault analysis system accumulates message patterns during faults in the past in any given information processing system, and detects a fault in another information processing system by collating the message pattern with a message pattern obtained during an operation of the another information processing system. This fault analysis system performs collation by increasing the degree of abstraction for a portion where the message patterns do not match during collation.